|
|
|
Routers called Area Border Routers (ABR) have interfaces to multiple areas. ABRs compact the topological information for an area and transmit it to the backbone area. Check Point supports the implementation of ABR behavior as outlined in the Internet draft of the Internet Engineering Task Force (IETF). The definition of an ABR in the OSPF specification as outlined in RFC 2328 does not require a router with multiple attached areas to have a backbone connection. However, under this definition, any traffic destined for areas that are not connected to an ABR or that are outside the OSPF domain is dropped. According to the Internet draft, a router is considered to be an ABR if it has more than one area actively attached and one of them is the backbone area. An area is considered actively attached if the router has at least one interface in that area that is not down.
Rather than redefine an ABR, the Check Point implementation includes in its routing calculation summary LSAs from all actively attached areas if the ABR does not have an active backbone connection, which means that the backbone is actively attached and includes at least one fully adjacent neighbor. You do not need to configure this feature; it functions automatically under certain topographies.
OSPF uses the following types of routes:
All routers on a link must agree on the configuration parameters of the link. All routers in an area must agree on the configuration parameters of the area. A separate copy of the SPF algorithm is run for each area. Misconfigurations prevent adjacencies from forming between neighbors, and routing black holes or loops can form.
Gaia supports the OSPF protocol in clusters configured either via VRRP or ClusterXL.
In this configuration, the cluster becomes a Virtual Router. The neighbor routers see it as a single router, where the virtual IP address of the cluster becomes the router ID. Each member of the cluster runs the OSPF process, but only the master actively exchanges routing information with the neighbor routers. When a failover occurs, a standby member of the cluster becomes the master and begins exchanging routing information with the neighbor routers.
Gaia also supports the OSPF protocol over VPN tunnels which terminate in the VRRP or ClusterXL cluster.
VRRP
Gaia supports advertising of the virtual IP address of the VRRP Virtual Router instead of the actual interface IP address. If you enable this option, but do not enable Graceful Restart, OSPF runs only on the master of the Virtual Router. During a failover, a traffic break may occur, while the new VRRP master becomes active and learns the OSPF routes. This happens because the OSPF route database exists only on the master and is not synchronized on all members of the cluster. The larger the network, the more time it takes OSPF to synchronize its database and install routes again.
To avoid traffic loss during failovers, you can configure Graceful Restart. In this case, the master synchronizes the route table with the VRRP backup member. If the master fails, the backup member takes on a role of the new master, sends grace-LSAs to the OSPF neighbors, and establishes adjacencies with them. The new master keeps the kernel routes that were installed before the failover until it establishing full adjacency with the neighbors.
|
Note - You must use monitored-circuit VRRP, not VRRP v2, when configuring virtual IP support for OSPF or any other dynamic routing protocol. |
|---|
ClusterXL
Gaia ClusterXL advertises the virtual IP address of the ClusterXL Virtual Router. The OSPF routes database of the master is synchronized across all members of the cluster. The OSPF task of each standby member obtains routing state and information from the master and installs the routes in the kernel as the master does. On a failover, one of the standby members becomes the new master and then continues where the old master failed. During the time that the new master resynchronizes routes database with the neighbor routers, traffic forwarding continues using the old kernel routes until OSPF routes are fully synchronized and pushed into the kernel.
When OSPF is configured with a low dead interval or too many OSPF neighbors or OSPF routes, routers can become too busy to send the OSPF hello packets on time. This can cause OSPF dead timers to expire on neighbors and cause outages. To prevent this behavior, the OSPF Forced Hellos feature was introduced. With this feature enabled, OSPF sends out hello packets at specified intervals when it processes updates or synchronizes routes. These hello packets are in addition to the regular hello packets in OSPF.
To configure OSPF:
|
Note - To prevent an address range from being advertised into the backbone, select Restrict for the address range |
The following table shows the global settings that you can specify for OSPF. Configure these settings by clicking OSPF under Configuration > Routing Configuration in the tree view and scrolling down to these fields.
Global Settings for OSPF
Parameter |
Description |
|---|---|
Router ID |
The Router ID uniquely identifies the router in the autonomous system. The router ID is used by the BGP and OSPF protocols. We recommend setting the router ID rather than relying on the default setting. This prevents the router ID from changing if the interface used for the router ID goes down. Use an address on a loopback interface that is not the loopback address (127.0.0.1). Note - In a cluster, you must select a router ID and make sure that it is the same on all cluster members.
|
RFC1583 Compatibility |
This implementation of OSPF is based on RFC2178, which fixed some looping problems in an earlier specification of OSPF. If your implementation is running in an environment with OSPF implementations based on RFC1583 or earlier, enable RFC 1583 compatibility to ensure backwards compatibility.
|
SPF Delay |
Specifies the time in seconds the system will wait to recalculate the OSPF routing table after a change in topology.
|
SPF Hold Time |
Specifies the minimum time in seconds between recalculations of the OSPF routing table.
|
Default ASE Route Cost |
Specifies a cost for routes redistributed into OSPF as ASs. Any cost previously assigned to a redistributed routed overrides this value. |
Default ASE Route Type |
Specifies a route type for routes redistributed into OSPF as ASs, unless these routes already have a type assigned. There are two types:
|
This table lists the parameters for areas and global settings that you use when configuring OSPF on your system. As you add areas, each is displayed with its own configuration parameters under the Areas section.
OSPF Normal Type Area Configuration Parameters
Parameter |
Description |
|---|---|
Add Address Range |
You can configure any area with any number of address ranges. Use these ranges to reduce the number of routing entries that a given area emits into the backbone and thus all areas. If a given IPv4 address aggregates a number of more specific IPv4 addresses within an area, you can configure an address that becomes the only IPv4 address advertised into the backbone. You must be careful when configuring an address range that covers parts of an IPv4 address not contained within the area. By definition, an address range consists of a IPv4 address and a mask length. Note: To prevent a specific IPv4 address from being advertised into the backbone, select Restrict. |
Add Stub Network |
OSPF can advertise reachability to IPv4 addresses that are not running OSPF using a stub network. The advertised IPv4 address appears as an OSPF internal route and can be filtered at area borders with the OSPF area ranges. The IPv4 address must be directly reachable on the router where the stub network is configured; that is, one of the router's interface addresses must fall within the IPv4 address to be included in the router-LSA. You configure stub hosts by specifying a mask length of 32. This feature also supports advertising an IPv4 address and mask that can be activated by the local address of a point-to-point interface. To advertise reachability to such an address, enter an IP address and a cost with a value other than zero. |
Area Type |
For descriptions of area types, see Types of Areas.
|
Stub Area Parameters
The following table stub areas configuration parameters appear if you define the area as a stub area.
Parameter |
Description |
|---|---|
Cost for Default Route |
Enter a cost for the default route to the stub area.
|
Import Summary Routes |
Specifies if summary routes (summary link advertisements) are imported into the stub area or NSSA. Each summary link advertisement describes a route to a destination outside the area, yet still inside the AS (i.e. an inter-area route). These include routes to networks and routes to AS boundary routers.
|
NSSA (Not So Stubby Area) Parameters
The following table describes the configuration parameters for NSSA areas. These fields appear if you define the area as an NSSA (Not So Stubby Area). For more information on NSSA, see RFC 3101.
Parameter |
Description |
|---|---|
Translator Role |
Specifies whether this NSSA border router will unconditionally translate Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are translated into Type-5 LSAs regardless of the translator state of other NSSA border routers. When role is Candidate, this router participates in the translator election to determine if it will perform the translations duties. If this NSSA router is not a border router, then this option has no effect.
|
Translator Stability Interval |
Specifies how long in seconds this elected Type-7 translator will continue to perform its translator duties once it has determined that its translator status has been assumed by another NSSA border router. This field appears only if an area is defined as an NSSA with translator role as Candidate.
|
Import Summary Routes |
Specifies if summary routes (summary link advertisements) are imported into the stub area or NSSA. Each summary link advertisement describes a route to a destination outside the area, yet still inside the AS (i.e. an inter-area route). These include routes to networks and routes to AS boundary routers.
|
Cost for Default Route |
Enter a cost associated with the default route to the NSSA. |
Default Route Type |
Specifies the route type associated with the Type-7 default route for an NSSA when routes from other protocols are redistributed into OSPF as ASs. If a redistributed route already has a route type, this type is maintained. If summary routes are imported into an NSSA, only then a Type-7 default route is generated (otherwise a Type-3 default route is generated). This field appears only if an area is defined as an NSSA into which summary routes are imported. The route type can be either 1 or 2. A type 1 route is internal and its metric can be used directly by OSPF for comparison. A type 2 route is external and its metric cannot be used for comparison directly.
|
Redistribution |
Specifies if both Type-5 and Type-7 LSAs or only Type-7 LSAs will be originated by this router. This option will have effect only if this router is an NSSA border router and this router is an AS border router.
|
Type 7 Address Ranges |
An NSSA border router that performs translation duties translates Type-7 LSAs to Type-5 LSAs. An NSSA border router can be configured with Type-7 address ranges. Use these ranges to reduce the number of Type-5 LSAs. Many separate Type-7 networks may fall into a single Type-7 address range. These Type-7 networks are aggregated and a single Type-5 LSA is advertised. By definition, a Type-7 address range consists of a prefix and a mask length. Note - To prevent a specific prefix from being advertised, select On in the Restrict field next to the entry for that prefix. |
To configure an OSPF interface:
The OSPF interface configuration parameters are displayed showing the default settings. If you want to accept the default settings for the interface, no further action is necessary.
|
Note - The hello interval, dead interval, and authentication method must be the same for all routers on the link. |
Configuration Parameters for OSPF Interfaces
Parameter |
Description |
|---|---|
Area |
The drop-down list displays all of the areas configured and enabled on your platform. An entry for the backbone area is displayed even if it is disabled. An OSPF area defines a group of routers running OSPF that have the complete topology information of the given area. OSPF areas use an area border router (ABR) to exchange information about routes. Routes for a given area are summarized into the backbone area for distribution into other non‑backbone areas. An ABR must have at least two interfaces in at least two different areas. For information on adding an area Configuring OSPF Areas and Global Settings. |
Hello interval |
Specifies the length of time in seconds between hello packets that the router sends on this interface. For a given link, this value must be the same on all routers, or adjacencies do not form.
|
Dead interval |
Specifies the number of seconds after the router stops receiving hello packets that it declares the neighbor is down.
|
Retransmit interval |
Specifies the number of seconds between LSA retransmissions for this interface. This value is also used when retransmitting database description and link state request packets. Set this value well above the expected round-trip delay between any two routers on the attached network. Be conservative when setting this value to prevent necessary retransmissions.
|
OSPF cost |
Specifies the weight of a given path in a route. The higher the cost you configure, the less preferred the link as an OSPF route. For example, you can assign different relative costs to two interfaces to make one more preferred as a routing path. You can explicitly override this value in route redistribution.
|
Election priority |
Specifies the priority for becoming the designated router (DR) on this link. When two routers attached to a network both attempt to become a designated router, the one with the highest priority wins. If there is a current DR on the link, it remains the DR regardless of the configured priority. This feature prevents the DR from changing too often and applies only to a shared-media interface, such as Ethernet. A DR is not elected on point-to-point type interfaces. A router with priority 0 is not eligible to become the DR.
|
Passive |
Specifies that the interface does not send hello packets, which means that the link does not form any adjacencies. This mode enables the network associated with the interface to be included in the intra-area route calculation rather than redistributing the network into OSPF and having it as an ASE. In passive mode, all interface configuration information, with the exception of the associated area and the cost, is ignored.
|
Use Virtual Address |
Makes OSPF run only on the VRRP Virtual IP address associated with this interface. If this router is not a VRRP master, then OSPF will not run if this option is On. It will only run on the VRRP master. For more information, see Configuring Monitored-Circuit VRRP.
|
Authorization Type |
Specifies which type of authentication scheme to use for a given link. In general, routers on a given link must agree on the authentication configuration to form neighbor adjacencies. This feature guarantees that routing information is accepted only from trusted routers. Options are:
|
You must configure a virtual link for any area that does not connect directly to the backbone area. You configure the virtual link on both the ABR for the discontiguous area and another ABR that does connect to the backbone.
The virtual link acts like a point-to-point link. The routing protocol traffic that flows along the virtual link uses intra-area routing only.
To configure a virtual link:
